Real world example: Stuxnet Worm - Pennsylvania State University
Uncovering Duqu - USENIX · Stuxnet was the first publicly known malware designed to cause...
24
Usenix Leet - San Jose, CA 1 Uncovering Duqu The Stuxnet Attackers Return Nicolas Falliere 4/24/2012
Transcript of Uncovering Duqu - USENIX · Stuxnet was the first publicly known malware designed to cause...
Usenix Leet - San Jose, CA 1
Uncovering Duqu The Stuxnet Attackers Return
Nicolas Falliere 4/24/2012
Agenda
2
Revisiting Stuxnet 1
Discovering Duqu 2
3 Inside Duqu
5 Summary
4 Weird, Wacky, and Unknown
3
Revisiting Stuxnet
Key Facts
4
Windows worm discovered in July 2010
Uses 7 different self-propagation methods
Uses 4 Microsoft 0-day exploits + 1 known
vulnerability
Leverages 2 Siemens security issues
Contains a Windows rootkit
Used 2 stolen digital certificates
Modified code on Programmable Logic Controllers
(PLCs)
First known PLC rootkit
5
Cyber Sabotage
6
Discovering Duqu
7
Boldi Bencsath (CrySyS) emails: “important malware Duqu”
Announce discovery and publish 25 page paper on Duqu
Boldi emails: “DUQU DROPPER FOUND MSWORD 0DAY INSIDE”
Hours later the C&C is wiped
8
Inside Duqu
Key Facts
9
Duqu uses the same code as Stuxnet except payload is different
Payload isn‟t sabotage, but espionage
Highly targeted
Used to distribute infostealer components
Dropper used a 0-day (Word DOC w/ TTF kernel exploit)
Driver uses a stolen digital certificate (C-Media)
No self-replication, but can be instructed to copy itself to remote machines
Multiple command and control servers that are simply proxies
Infections can serve as peers in a peer-to-peer C&C system
Countries Infected
10
Six organizations, in 8 countries confirmed infected
Architecture
11
Main component
A large DLL with 8 or 6 exports and 1 main resource block
Resource= Command & Control module
Copies itself as %WINDIR%\inf\xxx.pnf
Injected into several processes
Controlled by a Configuration Data file
Lots of similarities with Stuxnet
Organization
Code
Usual lifespan: 30 days
Can be extended
Installation
12
Signed Drivers
13
Some signed (C-Media certificate)
Revoked on October 14
Command & Control Module
14
Communication over TCP/80 and TCP/443 Embeds protocol under HTTP, but not HTTPS
Includes small blank JPEG in all communications
Basic proxy support
Complex protocol TCP-like with fragments, sequence and ack. numbers,
etc.
Encryption AES-CBC with fixed Key
Compression LZO
Extra custom compression layer
Infections can serve as proxies to enable a peer-to-peer C&C system
Payloads
15
C&C sends modules to the infected systems
Executed directly in memory
Saved to disk encrypted
Modules seen
Infostealer
Reconnaissance module
“Lifespan expansion” module
16
Weird, Wacky, and Unknown
TTF 0-Day Exploit
17
Vulnerability in GDI in Win32k.sys processing a TTF
object
Able to modify 1 byte
TTF 0-Day Exploit
18
Font file claims to be "Dexter Regular" by "Showtime Inc.,"
Dexter is a television series about Dexter Morgan, a blood pattern analyst for the Miami Metro Police Department
He moonlights as a serial killer, but only kills other murderers
The font file only has two characters defined
: )
Link with “Stars” Virus
19
In April 2011 Iranian officials stated they were hit by
a virus named “Stars”
Inside one of the keylogger components is a partial
image
Used before an embedded MZ file
Perhaps used to obfuscate the embedded MZ file
Link with “Stars” Virus
20
Odd Code
21
Duqu is almost entirely C++
The C&C module is not C++, but very much like it
Object oriented
Function table is directly in the class instance and can be modified after the constructor is called
Objects communicate using method calls, queues, and event callbacks
Constructors and destructors
Function table locations are not fixed (some at offset 0, some not)
Member functions can be called directly or via the object function table
The „this‟ pointer can be in any register or stack
Most likely C, with custom C++ features added
Conclusion
22
Stuxnet was the first publicly known malware
designed to cause “real” real-world damage
Duqu shares many similarities but is used for
espionage
Both required resources at the level of a nation-state
Raises attribution issues
Created by the same organization
Level of sophistication is singular
Attackers have not gone away
New Duqu binary compiled in Feb 2012
More information
23
Check out Symantec‟s papers and blogs
Questions?
Thank you!
24
